A reduction from an LWE problem to maximum independent set problems

The learning with errors (LWE) problem is a problem derived from machine learning that is believed to be intractable for quantum computers. This paper proposes a method that can reduce an LWE problem to a set of maximum independent set (MIS) problems, which are graph problems that are suitable for a quantum annealing machine to solve. The reduction algorithm can reduce an n-dimensional LWE problem to several small MIS problems with at most \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$2^{O(\sqrt{n})}$$\end{document}2O(n) nodes when the lattice-reduction algorithm used in the LWE-reduction method successfully finds short vectors. The algorithm is useful for solving LWE problems in a quantum-classical hybrid manner by using an existing quantum algorithm to solve the MIS problems. For example, the smallest LWE challenge problem is reduced to MIS problems with about 40,000 vertices. This result means that the smallest LWE challenge problem will be within the scope of a real quantum computer in the near future.


A reduction from an LWE problem to maximum independent set problems Yasuhito Kawano
The learning with errors (LWE) problem is a problem derived from machine learning that is believed to be intractable for quantum computers. This paper proposes a method that can reduce an LWE problem to a set of maximum independent set (MIS) problems, which are graph problems that are suitable for a quantum annealing machine to solve. The reduction algorithm can reduce an n-dimensional LWE problem to several small MIS problems with at most 2 O( √ n) nodes when the lattice-reduction algorithm used in the LWE-reduction method successfully finds short vectors. The algorithm is useful for solving LWE problems in a quantum-classical hybrid manner by using an existing quantum algorithm to solve the MIS problems. For example, the smallest LWE challenge problem is reduced to MIS problems with about 40,000 vertices. This result means that the smallest LWE challenge problem will be within the scope of a real quantum computer in the near future.
Verifying a quantum advantage (or supremacy) compared to a classical computer is one of the most exciting challenges of developing a quantum computer. In 2019, a quantum advantage was confirmed using a superconductor quantum device and the task of sampling the output of a pseudo-random quantum circuit 1 . The task was performed in 200 seconds by a newly developed 53-qubit quantum processor called "Sycamore, " whereas it was estimated that a state-of-the-art classical computer would take approximately 10,000 years to perform an equivalent task. In 2020, a quantum advantage was confirmed using a photonic quantum device and the task of boson sampling 2 . The sampling rate of the quantum device was faster than the sampling rate obtained using a state-of-the-art simulation strategy and supercomputers by a factor of ∼ 10 14 . Quantum advantages will be verified using quantum devices and intractable problems typified by sampling problems in the years to come.
There are three main approaches to verifying a quantum advantage. The first is to calculate an inversion of a classically hard one-way function, such as by performing factoring using Shor's algorithm 3 . The second is to sample from a classically hard-to-sample distribution, such as by performing boson sampling 4 . The third is to verify that an untrusted device is truly quantum by using interactive protocols 5 .
In this paper, the problem of learning with errors (LWE) 6 is studied as a candidate problem for verifying a quantum advantage; it belongs to the first approach. The LWE problem arises from machine learning and is believed to be intractable for a quantum computer. The intractability of the LWE problem is the basis for the security of LWE cryptography.
Using LWE problems to verify a quantum advantage has several advantages. First, a quantum-classical hybrid algorithm that solves LWE problems can be applied to machine learning. Second, the results of estimating the power of quantum computers can be applied to determine secure key lengths for LWE cryptography. Third, if an open LWE challenge problem was solved by a quantum computer, no one would be able to question the verification of the quantum advantage. (A classical simulator for pseudo-random quantum circuits as fast as Sycamore was proposed by Liu et al. 7 ; hence, the proof of the quantum advantage 1 has been questioned.) On the other hand, a disadvantage of this approach is that it is difficult to develop a quantum algorithm that solves LWE problems faster than classical algorithms. Estimating the number of qubits is also difficult. A naive encoding strategy requires a tremendously large number of qubits to encode an open LWE challenge problem. However, using the power of a classical computer can lessen the burden on the quantum (or quantum-inspired) computer.
To make it easier to solve an LWE problem using a quantum (or quantum-inspired) computer, we introduce a reduction of an LWE problem to another problem that is similar to an LWE problem. The reduction algorithm is called LWE-reduction in this paper. LWE-reduction can change the modulus of an LWE problem. It is easy to change the modulus to a larger number, whereas it is difficult to change the modulus to a smaller number in general. To change the modulus to a smaller number, a lattice-reduction algorithm is used. It is not guaranteed

Preliminaries
In this section, the relevant background material is explained. The details are given in Refs. 27-30 . Learning with errors (LWE). Let n be a positive integer. Let q be an integer larger than one. (n and q are called the dimension and the modulus of the LWE problem, respectively.) Let Z q be Z/qZ . Let σ > 0 be the standard deviation. Let N(0, σ 2 ) be the Gaussian distribution on Z q with a mean value of zero and a standard deviation σ . For a fixed unknown vector s ∈ Z n q , let S s,σ be a set of a polynomial number of samples (a, �a, s� + e mod q) , where a ← U Z n q and e ← N(0, σ 2 ) are randomly selected. Solving an LWE problem consists of finding s ∈ Z n q from a given S s,σ . Let m be the number of samples in S s,σ . Denote a and e of the ith sample (i = 1, . . . , m) by a i and e i , respectively. Let A be the m × n matrix made from the row vectors a 1 , a 2 , . . . , a m . Let e be the m-dimensional column vector made from e 1 , e 2 , . . . , e m . Let t be the m-dimensional column vector made from �a i , s� + e i mod q . An LWE problem is the problem of finding a vector s that satisfies www.nature.com/scientificreports/ such that the distributions of the components of e follow the Gaussian distribution N(0, σ 2 ) . The above LWE problem will be denoted by the four-tuple A, t, q, σ . The problem of finding an s that satisfies Eq. (1), where the distributions of the components of e may have different standard deviations, will be referred to as an LWE-like problem. In addition, the LWE-like problem allows fractional numbers to be components of t and e . (Instead of a Gaussian distribution on Z q , a Gaussian distribution on {(t j + z) mod q|z ∈ Z} is used in the definition.) An LWE-like problem will be denoted by a four-tuple A, t, q, {σ j } m j=1 .
Bounded distance decoding (BDD). One of the standard strategies that is used to solve an LWE problem is BDD 31 . BDD is a problem similar to the closest vector problem. Let X be a set of n m-dimensional row vectors, i.e., X = {x 1 , . . . , x n } for m-dimensional row vectors x 1 , . . . , x n . For an integer q, define the lattice � q (X) as follows: Then, � q (X) is the lattice generated by the vectors in X and qu 1 , . . . , qu m , where u 1 , . . . , u m are m-dimensional unit vectors. A basis of � q (X) is efficiently obtained by calculating the Hermite decomposition of the The BDD problem is as follows. Suppose that there is a number 0 < µ ≤ 1 2 such that, for a lattice L and a target vector t, holds, where 1 (L) is the length of the shortest vector in L. The BDD problem involves, given a basis of L, finding the vector v ∈ L closest to t.
The BDD problem can be regarded as a problem similar to the closest vector problem. Hence, the nearest plane algorithm 17 for the closest vector problem can be applied to solve the BDD problem.
Dual lattice. The dual lattice � ⊥ q (X) of � q (X) is defined as follows: Consider the case in which X is the set of row vectors of t A , where A is the matrix of the LWE problem described by Eq. (1). A basis of � ⊥ q ( t A) is calculated as the right-lower m × m matrix of the transforming matrix of the Hermite decomposition of the 2m × m matrix qI m B , where B is a basis of � q ( t A).
We consider a superposition of quantum states on the dual lattice � ⊥ q ( t A): where D := � ⊥ q ( t A) ∩ [0, q) ⊗m . By using the rotation gates according to the target vector t , the following quantum state can be efficiently made: In this paper, the quantum state |ψ t � will be called a t-rotated state.
Let R be a small region around the origin contained in [0, q) ⊗m such that � ⊥ q ( t A) ∩ R � = ∅ . The t-rotated state on R is defined as Let c be the closest vector of t in � q ( t A) . Let e be t − c . It is obvious that ψ t,R = ψ e,R . Hence, if t ∈ � q ( t A) , then ψ t,R = ψ 0,R . If t is close to a lattice point in � q ( t A) , then ψ t,R ≈ ψ 0,R since �e, x� ≈ 0 for any The closer t is to a lattice point in � q ( t A) , the closer ψ t,R is to ψ 0,R . Notation. The following notation will be used in this paper. The symbol A [a 1 :a 2 ,b 1 :b 2 ] represents a submatrix of an m × n matrix A consisting of the rows from a 1 to a 2 (including both a 1 and a 2 ) and the columns from b 1 to b 2 (including both b 1 and b 2 ), where 1 ≤ a 1 < a 2 ≤ m and 1 ≤ b 1 < b 2 ≤ n . The numbers of the first (or last) row (or column) can be eliminated. A negative number indicates the row (or column) that is that number of rows (1) t ≡ As + e mod q

LWE-reduction
We begin by explaining the idea of LWE-reduction. Then, LWE-reduction is described in Algorithm 1.

Idea.
As explained in the previous section, by comparing ψ t,R and ψ 0,R , it can be determined whether t is close to a lattice point in � q ( t A) or not. However, it is difficult to find points in � ⊥ q ( t A) ∩ R in general. To make it easier to find such points, we consider a new lattice by adding (interpolating) new points to ⊥ q t A . Let n ′ and q ′ be integers larger than one. Select x 1 , . . . , x n ′ ∈ ⊥ q t A such that q ′ x 1 , . . . , q ′ x n ′ ∈ � ⊥ q ( t A) . The points represented by x 1 , . . . , x n ′ are called the interpolated points. Let L be the lattice generated by Then, finding points in L ∩ R may be easier than finding points in � ⊥ q ( t A) ∩ R . Select y 1 , . . . , y m ′ ∈ L ∩ R such that {y 1 , . . . , y m ′ } are linearly independent and call y 1 , . . . , y m ′ the sample points. (Note that the coordinates of x 1 , . . . , x n ′ , y 1 , . . . , y m ′ are not integers in general.) Let c be the lattice point in � q ( t A) closest to t . Let e be t − c . Since t = c + e, 3) has three terms. Since y 1 , . . . , y m ′ ∈ L , they are written as linear combinations of {x 1 , . . . , . Since �b 1 , c� ≡ · · · ≡ �b m , c� ≡ 0 mod q , �y 1 , c�, . . . , �y m ′ , c� are equal to linear combinations of �x 1 , c�, . . . , �x n ′ , c� modulo q. Hence, Eq. (3) can be written as for some integral m ′ × n ′ matrix A ′ . It can be easily seen that �x 1 , c�, . . . , �x n ′ , c� are q q ′ ×integers. By applying q ′ q to all terms, Eq. (4) can be converted into where all components of the second term are integers. Since e, y 1 , . . . , y m ′ are short vectors, the third term of Eq. (5) is a short vector.
Regard the first and third terms as the target and error vectors, respectively, of a new LWE-like problem. Then, Eq. (5) looks similar to an LWE problem. LWE-reduction algorithm. Algorithm 1 reduces an LWE problem to an LWE-like problem with an arbitrary modulus. Whether the reduced LWE-like problem has a unique solution or not depends on the set of sample points X in the algorithm.
Algorithm 1 Input (A, t, q, σ ) , an n-dimensional LWE problem with m samples and a standard deviation σ , i.e., for an m × n matrix A, m-dimensional column vector t , and integer q (not necessarily prime), there are column vectors s = t (s 1 , . . . , s n ) and e = t (e 1 , . . . , e m ) such that and each e j (j = 1, . . . , m) follows the Gaussian distribution N(0, σ 2 ).
Input m ′ and n ′ , positive integers less than or equal to m. ( m ′ and n ′ represent the number of samples and the dimension of the reduced LWE-like problem, respectively.) Input q ′ , an integer larger than one. ( q ′ represents the modulus of the reduced LWE-like problem.) Calculate an m ′ × n ′ matrix A ′ and an m ′ -dimensional column vector t ′ as follows: 1. Select a basis of � q ( t A) . It is denoted by B.
2. Select a basis of � ⊥ q ( t A) such that all components of the last n ′ row vectors are q times integers. It is denoted by B . 3. Let B ′ be the basis defined by replacing the last n ′ row vectors of B with 1 q ′bm−n ′ +1 , . . . , 1 q ′bm , respectively, i.e., www.nature.com/scientificreports/ Here, 1 q ′bm−n ′ +1 , . . . , 1 q ′bm � ∈ L (B) . (Note that B ′ is a matrix whose entries are rational numbers.) 4. Let X be a linearly independent set of vectors Note that any component of T is an integer. (If X is a basis, then T is the transformation matrix from B ′ to X .) 7. An integral matrix A ′ and a column vector t ′ with rational components are defined by be an n-dimensional LWE problem with m samples and a standard deviation σ , i.e., there is an n-dimensional column vector s and an m-dimensional error vector e = t (e 1 , . . . , e m ) such that where e j follows the Gaussian distribution N(0, σ 2 ) . Let X be the set of linearly independent vectors selected at Step be the output of Algorithm 1 for the inputs (A, t, q, σ ) , q ′ , m ′ , and n ′ . Let s ′ and e ′ be the n ′ -dimensional column vector in Z n ′ q ′ and the m ′ -dimensional column vector in In addition, the error e ′ i follows the Gaussian distribution Proof By Eq. (9), . www.nature.com/scientificreports/ Combining Eqs. (16) and (17) implies that Change the modulus from q to q ′ . Then, The A ′ , t ′ , s ′ , and e ′ defined by Eqs. (10), (11), (13), and (14) satisfy Eq. (15). Next, we prove that for each i = 1, . . . , m ′ , e ′ i follows the Gaussian distribution N(0, σ ′2 l 2 i ) . The mean value is obviously zero. It will now be shown that the standard deviation is σ ′ l i . Using Eq. (14), an error vector e is mapped to a vector equivalent to q ′ qX e mod q ′ by the LWE-reduction algorithm. Here, each component of e follows the Gaussian distribution with a mean value of zero and a standard deviation σ . Let In general, the uniqueness of the solution of the LWE-like problem is not guaranteed. It depends on the selection of B , B , X , m ′ , and n ′ . We introduce the standard settings for these parameters.

Definition 1
The standard setting of the parameters in Algorithm 1 is defined as follows: • B and B are row vectors of the Hermite normal forms of the bases of � q ( t A) and � ⊥ q ( t A) , respectively. • m ′ = m and n ′ = n.
When q is a prime number, the Hermite normal form of a basis of � q ( t A) takes the form I n B * O m−n,n qI m−n for some n × (m − n) matrix B * , and the Hermite normal form of a basis of � ⊥ q ( t A) takes the form I m−nB * O n,m−n qI n for some (m − n) × n matrix B * . Hence, B and B are row vectors of those matrices. Then, X represents the row vectors of Proposition 1 says that both the standard deviations of the distributions of the error components and the length among the closest lattice points of BDD defined from the LWE-like problem are about q ′ q times those of the LWE problem when q is a prime number and q ′ and m are sufficiently large. Hence, it is expected that the LWE-like problem has a unique solution when it is reduced by the LWE-reduction algorithm in the standard setting when q is a prime number and q ′ and m are sufficiently large.
, m, n, m ′ , and n ′ have the same meanings as in Theorem 1. Suppose that B , B , X , m ′ , and n ′ are in the standard setting. Suppose that q is prime.

The standard deviations of the LWE-like problem are less than or equal to
, which is close to σ ′ when q ′ is sufficiently greater than q. Hence, the standard deviation of the LWE-like problem is about times that of (A, t, q) . It is close to q ′ q when m is sufficiently greater than n.  www.nature.com/scientificreports/ Proof 1. Since q is prime, X is the set of row vectors of 2. Since � q ( t A) has the form I n B * O m−n,n qI m−n , the Gaussian heuristic 30 Dividing the latter by the former Suppose that q is prime and there is a unique solution of the LWE-like problem In the standard setting, the solution of the LWE problem can be calculated from the solution of the LWE-like problem as follows.
, m, n, m ′ , and n ′ have the same meanings as in Theorem 1. Suppose that B , B , X , m ′ , and n ′ are in the standard setting. Suppose that q is a prime number, q ′ ≥ 2q , and there is a unique

Quantum-classical hybrid algorithm
By using the LWE-reduction algorithm, an LWE problem with a modulus q can be reduced to an LWE-like problem with a modulus q ′ . As shown in the previous section, it is expected that the LWE-like problem will have a unique solution when q is a prime number and q ′ and m are sufficiently large. However, when it comes to solving an LWE-like problem, a smaller q ′ is better. Unfortunately, there are two problems with changing the modulus to a smaller number by using the LWE-reduction algorithm. One is that the uniqueness of the solution of the reduced LWE-like problem is not guaranteed. The other is that even if the solution of the LWE-like problem is unique, the solution of the LWE problem cannot be easily calculated from the solution of the LWE-like problem obtained from Algorithm 1 when q ′ is coprime to q. In this section, we present a method for reducing an LWE problem to an LWE-like problem with a smaller modulus and solving that LWE problem. The idea is to make the modulus of an LWE problem small in two stages, i.e., the modulus is increased to a large composite number in the first stage and then reduced to its divisor in the second stage. In addition, a lattice-reduction algorithm is used to find short vectors of X in the second stage. For example, the modulus q is increased to 2 r for some r ≥ log 2 q in the first stage and is reduced to two in the second stage. The LWE problem with a prime modulus is then reduced to modulo-two LWE-like problems. We assume that the errors of the LWE-like problems are sufficiently small. By ignoring the errors, the modulo-two LWE-like problems can be represented as maximum satisfiability (MAX-SAT) problems. By solving these MAX-SAT problems, partial information about the solution of the LWE problem is obtained. To determine the solution, the LWE-reduction algorithm and an algorithm for MAX-SAT problems are run recursively. Since a MAX-SAT problem has been reduced to a maximum independent set (MIS) problem 32 and a number of quantum algorithms for MIS problems are available 8,9 , the algorithm can be performed by quantum and classical computers in a hybrid manner.
Suppose that (A, t, 2 r , σ ) is an LWE problem obtained using Algorithm 1 in the standard setting. (More precisely, it could have different standard deviations, according to Theorem 1; however, we assume that they are the same because Algorithm 1 in the standard setting outputs an LWE-like problem with an error vector whose components follow almost the same standard deviations. [See Proposition 1.]) The next algorithm (Algorithm 2) describes the second stage, which recursively calls Algorithm 1 with q ′ = 2, 4, 8, . . . , and reduces the LWE problem to modulo-two LWE-like problems (Eq. 22). (A, t, 2 r , σ ) , which is an n-dimensional LWE problem with m samples and a standard deviation σ , i.e., for an integral m × n matrix A, an m-dimensional column vector t with rational components, and an integer r, there are unique integral column vectors s = t (s 1 , . . . , s n ) and rational e = t (e 1 , . . . , e m ) such that and each e j (j = 1, . . . , m) follows the Gaussian distribution N(0, σ 2 ).

Algorithm 2 Input
Change the indices of the row vectors of A so that A [−n:,:] mod 2 is invertible in Z 2 . Denote the resulting matrix by the same symbol A. www.nature.com/scientificreports/ For i = 0, 1, . . . , r − 1 , calculate the n-dimensional vector s i , whose components are bits, as follows. We start with i = 0 . Set t 0 := t and σ 0 := σ .
1. Input (A, t i , 2 r−i , σ i ) , m, n, and 2 (as m ′ , n ′ , and q ′ , respectively) to Algorithm 1, which uses the Hermite nor- ) be an output. Here, the A ′ i 's are integral and the t ′ i 's have rational numbers as components.

Let s ′ i be a vector whose components are bits that is a solution of the LWE-like problem
where the jth component of e ′ i follows the Gaussian distribution N 0, σ ′2 i l 2 ij . 3. Calculate the n-dimensional vector s i , with bits as components, that satisfies 4. If i < r − 1 , then set increment i, and go to the first step. 5. Output r−1 j=0 2 j s j .
The output of Algorithm 2 is expected to be equal to the solution s of Eq. (21), as we will see below.  www.nature.com/scientificreports/ Suppose that for all j < i , s j is equal to the vector of bits consisting of the (j + 1) st least significant bits of the components of s . Let s i be 1 2 i s − i−1 j=0 2 j s j . Let s i be the vector obtained by changing the least significant bit of the components of s i to zero. By Eqs. (21) and (24), where the jth component of e i follows the Gaussian distribution N(0, σ 2 2 2i ) . Hence, s i is the solution of the LWE problem (A, t i , 2 r−i , σ i ) . Similar to the proof of Eq. (29), we can prove that Hence, the vector consisting of the least significant bit of the components of s i is a unique solution of Eq. (23) for i.

Graph size and Qubit number
As shown in the previous section, an LWE problem can be reduced to modulo-two LWE-like problems (Step 2 of Algorithm 2). This section calculates an upper bound for the size of the graphs that result from converting one of these modulo-two LWE-like problems and estimates the number of qubits needed to solve an LWE problem using the quantum-classical hybrid algorithm under the assumption that for each i = 0, 1, . . . , r − 1 , the standard deviations {σ ′ i l ij } m j=1 are sufficiently small, so that the LWE-like problem Suppose that there is a positive number δ such that all errors of the LWE-like problem Actually, since we do not know that there is a positive number δ such that all components of the errors of the , we will determine δ from a randomly generated LWE problem with the same dimension and relative error.
Reducing the simultaneous equations of Eq. (32) ( j ∈ � iδ ) to a quadratic unconstrained binary optimization (QUBO) problem consists of two reductions, a reduction from Eq. (32) to a conjunctive normal form (CNF) and a reduction from a CNF to a QUBO. The second reduction is the reduction from a MAX-SAT problem of a CNF with a total of t literals to a maximum independent set (MIS) problem of a graph with t vertices, following Chapuis et al. 8 . Since the weights on the edges of the graph are coded in two bits (they are 2 and −1 in the paper), the number of qubits necessary to solve the QUBO that represents the MIS problem is a few times the number of vertices. The first reduction is studied below.
First, we evaluate the number of clauses and the number of literals of a CNF reduced from a parity equation.

Lemma 1 A logical formula
can be expressed as a CNF with 2 k clauses and (k + 1) literals for each clause. (Hence, the total number of literals is (k + 1)2 k .)

Proof Equation (33) is equal to
Hence, it is sufficient to show that a k-variable (≥ 2) logical formula can be expressed as a CNF with 2 k clauses and (k + 1)2 k literals. Define ψ k and φ k (k ≥ 1) by (30) t i ≡ As i + e i mod 2 r−i ,  Proof It is easily checked that n =n + · · · +n µ + (n − 1) + · · · + (n − 1) ν . Since each component of A is a bit, each row of A has n bits. Divide each row of A into n, . . . ,n µ , (n − 1), . . . , (n − 1) ν bits. Then, each row of A can be represented as a set of µ n-bit numbers and ν (n − 1)-bit numbers. Let C be the m × (µ + ν) matrix consisting of those numbers. Let c i,j be the (i, j)th component of C.
Define the relation between x 1 , . . . , x n and y i,j as follows: Here, y i,c i,j is defined as an empty component when c i,j = 0 . By Lemma 1, the total number of literals of the CNF equivalent to Eq. (48) is (µ + ν)2 µ+ν−1 . Since the number of equations is m, the total number of literals of the CNF equivalent to Eq. (48) is at most m(µ + ν)2 µ+ν−1 . Since µ + ν = n − (n − 1)⌈ n n ⌉ +n⌈ n n ⌉ − n = ⌈ n n ⌉ , the total number of literals is bounded by Eq. (42).
The total number of literals is then 2 O( √ n) since n and ⌈ n n ⌉ are O( √ n) and m is bounded by a polynomial in n.

Complexity analysis
We analyze the complexities of the proposed algorithms. Algorithm 1 in the standard setting efficiently reduces an LWE problem to an LWE-like problem. Proposition 2 states the time complexity of the algorithm. On the other hand, Algorithm 2 is a heuristic algorithm. It is not guaranteed that the algorithm will output the correct answer for an input LWE problem even if sufficient time and space are provided. The reason for this is as follows.
if Rest(j) = 0 and i ≤ µ, x µn+(i−µ)(n−1)−log 2 j if Rest(j) = 0 and i > µ. www.nature.com/scientificreports/ To obtain the correct answer for an LWE problem using Algorithm 2, the solution of Eq. (22) must be successfully calculated in each loop. In our algorithm, instead of solving Eq. (22), an MIS problem obtained from Eq. (22) is solved. However, it is not guaranteed that the solution of Eq. (22) can be calculated from a solution of the MIS problem. This is because the solution of Eq. (22) may not satisfy Eq. (32) for all j ∈ � iδ . The smaller the number of Eq. (32) that holds for the solution of Eq. (22), the more difficult it is for a quantum annealing machine to find the solution. To reduce the burden on the quantum annealing machine that solves the MIS problem, a lattice-reduction algorithm such as the Lenstra-Lenstra-Lavász (LLL) algorithm or BKZ algorithm 16,21,22 is assumed to be used at Step 1 of Algorithm 2. Since vectors found by a lattice-reduction algorithm are set as sample points, we can expect the error (the third term) of Eq. (22) to be small. Unfortunately, a lattice-reduction algorithm takes a very long time to run. The LLL algorithm is a polynomial-time algorithm, but its performance is inadequate. The BKZ algorithm can find a shorter vector in general, but it needs a longer amount of time.
Even with such a shortcoming, it is worth considering using our algorithm to solve an LWE problem. The power of a quantum computer is definitely useful when solving an LWE problem. However, one of the biggest obstacles is that challenge problems are often too big to encode on today's quantum computers. By reducing the number of qubits needed to encode an LWE problem, our algorithm makes it possible for a quantum computer to solve this problem.

Implementation
We made a prototype of the LWE-reduction algorithm that reduces an LWE problem to MIS problems. The prototype was written in the Wolfram language (Mathematica 34 ) and Python (SageMath 35 ). The computer experiments were performed on an Ubuntu machine with two Intel(R) Xeon(R) E5-2680 v4 processors @ 2.40 GHz (each processor has 14 cores and 28 threads) and 256 GB of memory.
The We explain how to use LWE-reduction to reduce the 40-dimensional LWE challenge problem with a relative error of 0.005 to a graph. To select δ > 0 (see the section "Graph Size and Qubit Number"), an LWE problem with the same dimension (40) and relative error (0.005) is randomly generated. (Hence, we know the solution and error.) Algorithm 2 calculates the LWE-like problems is then reduced to a MAX-SAT problem that represents Eq. (32) for j ∈ 0.05 . Figure 3 shows a graph of an MIS problem that was reduced from the MAX-SAT problem. The graph has 36,664 vertices and 1,982,176 edges. We tried to reduce the LWE challenge problem with a dimension of 40 and a relative error of 0.035, which was still open as of June 21, 2021, to an MIS problem using the same strategy. An LWE problem with the same www.nature.com/scientificreports/ dimension and relative error was randomly generated and the error was calculated. Unfortunately, too many of the absolute values of the components of the error were larger than one. To make most of the error components smaller than one, it is necessary to find shorter vectors using a lattice-reduction algorithm. Replacing the latticereduction algorithm used in the prototype with a state-of-the-art algorithm would make the errors smaller.

Conclusion
This paper proposed a reduction from an LWE problem to a set of maximum independent set (MIS) problems. The algorithm is useful for solving LWE problems in a quantum-classical hybrid manner by using an existing quantum algorithm for the MIS problems. There are several reasons to study quantum-classical hybrid algorithms for LWE problems. First, quantum-classical hybrid algorithms that solve LWE problems can be applied to machine learning. Second, the results of estimating the complexities of quantum-classical hybrid algorithms for LWE problems can be applied to determine secure key lengths for LWE cryptography. Third, if an open LWE challenge problem was solved by a quantum computer, no one would be able to question the verification of the quantum advantage. Successfully solving an open LWE challenge problem using a quantum-classical hybrid algorithm would verify a quantum advantage. On the other hand, the biggest disadvantage of this approach is that it is difficult to develop a quantum-classical hybrid algorithm that solves an LWE problem faster than classical algorithms and to estimate the number of qubits needed to do this. A naive encoding strategy requires a tremendously large number of qubits to encode an open LWE challenge problem. The role of the LWE-reduction algorithm is to reduce an LWE problem to LWE-like problems with small moduli. Here, "LWE-like" means that the error distributions may have different standard deviations.
First, we introduced Algorithm 1, called LWE-reduction, which reduces an LWE problem to another LWElike problem. Theorem 1 showed a pair consisting of a concrete solution and the associated error of the LWElike problem. Algorithm 1 contains several bases and parameters to select. In general, depending on the setting of the bases and parameters, the LWE-like problem may have more than one solution. To make the solution unique, a standard setting of bases and parameters was introduced (Definition 1). Proposition 1 showed that the solution is expected to be unique when the bases and parameters are selected according to the standard setting. Theorem 2 showed that the solution of the LWE problem can be efficiently calculated from the solution of the LWE-like problem in the standard setting. Hence, it is sufficient to solve the LWE-like problem obtained using Algorithm 1 in the standard setting.
The smaller the modulus is, the easier it is to implement an LWE problem on a quantum computer. Unfortunately, when a modulus is decreased to an integer that is coprime to the modulus, the solution of the LWE problem cannot be easily calculated from the solution of the LWE-like problem obtained using Algorithm 1 in the standard setting. Since an LWE problem usually uses a prime modulus, Algorithm 1 in the standard setting cannot reduce the modulus. We thus used two stages to reduce the LWE problem. Algorithm 1 is run twice; the modulus of the LWE problem is increased to a power of two in the first stage and decreased to two in the second stage. Partial information about the solution of an LWE problem can be obtained from the solution of the reduced modulo-two LWE-like problem. To determine the solution of an LWE problem, the second stage is performed recursively. Algorithm 2 describes the recursive algorithm of the second stage. Theorem 3 showed that the solution of an LWE problem can be efficiently calculated from the solutions of modulo-two LWE-like problems under the assumption that the reduced modulo-two LWE-like problems are correctly solved. www.nature.com/scientificreports/ A modulo-two LWE-like problem is represented as a MAX-SAT problem of a logical formula. A conversion from a MAX-SAT problem to an MIS problem is known 32 . The number of graph nodes of the MIS was evaluated using Theorem 4. An upper bound was depicted in Fig. 1. Although the number of qubits depends on the hardware, the minimum number of qubits necessary to solve an LWE problem is estimated as a few times the number of graph nodes, since the weights of the graph are small. For example, the minimum number of qubits necessary to solve a 40-dimensional LWE problem, which is the smallest-dimensional problem in the Darmstadt LWE challenge, was estimated at about a few times 40,000. Open LWE challenge problems will be within the reach of quantum computers in the near future.
We implemented the LWE-reduction algorithm. The prototype was written in the Wolfram language (Mathematica) and Python (SageMath). It successfully reduced the 40-dimensional LWE challenge problem with a relative error of 0.005 to a modulo-two LWE problem in the first recursive call. The graph of this problem was shown in Fig. 3. The prototype failed to reduce the 40-dimensional LWE challenge problem with a relative error of 0.035, which was an open LWE challenge problem as of June 21, 2021. (There were too many errors larger than one.) To successfully reduce this LWE problem, a more efficient lattice-reduction algorithm should be used.
In future research, a better lattice-reduction algorithm should be employed to perform the reduction. Replacing the lattice-reduction function used in the prototype with a state-of-the-art lattice-reduction algorithm would improve the prototype. Another research direction involves solving the reduced MIS problem (shown in Fig. 3) using a real quantum-inspired machine that has more than 100,000 qubits. The power of the quantum-classical hybrid algorithm will be made clearer by the experimental results of such machines.

Data availability
The datasets used and/or analyzed during the current study are available from the corresponding author on reasonable request.